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Abstract 



' We prove lower bounds on the error probability of a quantum algorithm for searching through 

an unordered list of N items, as a function of the number T of queries it makes. In particular, 
if T S 0(s/N) then the error is lower bounded by a constant. If we want error < l/2 N then 
we need T € f2(iV) queries. We apply this to show that a quantum computer cannot do much 
better than a classical computer when amplifying the success probability of an RP-machine. A 
classical computer can achieve error < l/2 fc using k applications of the RP-machine, a quantum 
computer still needs at least ck applications for this (when treating the machine as a black- 
box), where c > is a constant independent of k. Furthermore, we prove a lower bound of 



0(ylogiV / log log N) queries for quantum bounded-error search of an ordered list of N items. 



o . 

1 Introduction 

00 ' 

Suppose we have an unsorted list of N items and we want to find an item with some specific 
property. For instance we want to find an item with a specific value at one of its fields. In the 
worst case, a classical deterministic or randomized computer will have to look at 0(iV) items to 
have a high probability of finding such an item if there is one. On the other hand, Grover's quantum 
search algorithm can perform look-ups or queries in superposition, and finds the desired item with 
high probability using only 0{\fN) queries. The following is known about the error probability e 
in quantum search: 



e can be made an arbitrarily small constant using 0{yN) queries [ Gro96 | but not using 
o(VN) queries (BBBV97], |BBHT98| , [Zai97l , |BBC + 98| , |Gro98afl . 



e can be made < l/2 Na using 0(N°- 5+a ) queries |BCW98| , Theorem 1.16]. 



If we want no error at all (e = 0), then we need N queries [BBC + 98, Corollary 6.2]. 



Many applications of quantum computing will need to apply quantum search several times as a 
subroutine. We should avoid that the errors of each application add up to an overall error that is 
too big. Accordingly, we should make the error probability of each application as small as possible, 
if necessary by spending slightly more than 0(y/N) queries. 

We give a detailed analysis of the trade-off between the error probability of a quantum search 
algorithm and the number of queries it uses. We obtain the following lower bound on e in terms of 
the number T of queries that the algorithm uses: 



e G U e 



-4bT 2 /N-8T/VN 
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where b is some fixed constant and we assume T < N. Our proof first translates a quantum search 
algorithm with T queries to a multivariate polynomial of degree d < 2T that has certain properties, 
and then uses techniques from |Pat92| and pR9l| to prove a lower bound on e in terms of d. This 



implies a lower bound in terms of T.[] In particular, this bound implies that e cannot be made o(l) 
using only 0{^/N) queries. Also, e can only be made < \/2 N using fi(7V) queries. 

In Section |5| we apply this bound to the derandomization of classical RP-machines (RP is the 
class of languages that can be recognized in polynomial time with one-sided error at most 1/2). A 
classical computer can achieve error < l/2 fc by running the RP-machine k times and answering 'yes' 
iff at least one of those k runs answered 'yes'. Since this is basically a search among k items, we 
would expect a quantum computer to be able to achieve error < l/2 fc using roughly \fk applications 
of the RP-machine. Somewhat surprisingly, we show that a quantum computer cannot do much 
better than the classical computer: it would also need at least ck applications of the machine to 
obtain error < l/2 k (when treating the machine as a black-box). Here c > does not depend on k. 
We interpret this as follows: general results on amplitude amplification [BHT98, Gro98b| , Mos98] 



show that a quantum computer can achieve a square-root speed-up when amplifying a very small 
success probability to a constant one, but our result shows that it can achieve at most a linear 
speed-up when amplifying a constant success probability to a probability very close to 1. 

Finally, in Section |6| we look at the problem of searching an ordered list of N items (ordered 
according to some key field of the items). Since many databases in practice are ordered rather than 
unordered, we feel this problem merits as much attention as the unordered search has received so 
far in the quantum computing literature. Classically, we can search such an ordered list with only 
\ogN queries using binary search. It is unknown whether a quantum computer can improve on 
this. However, we show that it cannot improve much more than a square-root: we prove a lower 
bound of £l{yflogN / log log N) queries for bounded-error quantum search in this setting, using a 
novel kind of quantum reduction from the PARITY-problem. 

To summarize: 

• We prove a general lower bound on the error in quantum search of an unordered list. 

• We apply this to show that a quantum computer can achieve at most a linear speed-up when 
amplifying an already-big success probability. 



We prove a lower bound of roughly y/\og N for quantum search of an ordered list of N items. 



2 Preliminaries 



In this section we define the setting of quantum gate networks (which are equivalent to quantum 
Turing machines [ Yao93|] ) and queries. 

A qubit is a superposition ao\0) + ai|l) of both values of a classical bit. Similarly, a register of 
m qubits is a superposition of all 2 m classical bitstrings of m bits, written 

\<t>)= E «*!*>• 
fce{o,i} m 

Here ct^ is a complex number, called the amplitude of state \k). If we observe \(f>) we will see one 



and only one \k). The probability of seeing one specific \k) is given by |ajt| 
= 1. After observing \<p) and seeing \k), the superposition | 



fce{o,i} m \ a k\ 



Hence we must have 
has collapsed to \k). 



1 Nayak and Wu [NW95] also use polynomial-techniques from [BBC + 9£] and [Pat92], in order to prove lower 
bounds for quantum computing the median and mean of a function. 
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If we do not observe a state, quantum mechanics tells us that it will evolve unitarily. This 
means that the vector of amplitudes is transformed according to a linear operator that preserves 
norm (so the sum of the amplitudes squared remains 1). A unitary operator U always has an 
inverse U -1 , which equals its conjugate transpose U*. A quantum gate network working on m 
qubits is like a classical circuit working on m classical bits, except that instead of AND-, OR-, and 
NOT-gates we have quantum gates which operate unitarily on one or more qubits. A quantum gate 
network transforms an initial state into a final state much in the way a classical circuit transforms 
its input into one or more output bits. It is known that operations on one or two qubits at a 



time are sufficient to build any unitary transformation | BBC + 95 |. The most common measure of 
complexity of a quantum gate network is the number of elementary quantum gates it contains, but 
in this paper we will disregard this and only count the number of queries. 

Making queries to a list X = (xo, • • • , ^tv-i) of N bits is incorporated in the model as follows. 
Classically, making a query to X means inputting some j G {0, . . . ,N — 1} into a black-box, 
and receiving the value Xj as output. A query gate O (for "oracle") performs the corresponding 
mapping, which is our only way to access the bits xy. 

li, o,o) -> \j, Xj ,o), 

where is a string of zeroes. Because O must be reversible, it also maps 

|i,l,0) -» \j,x],0). 

We will look at quantum networks that contain both elementary gates and query gates, but 
only count the latter. The advantage of a quantum computer over a classical computer is its 
ability to make queries in superposition: applying O once to the state -7= J2j I Ji 0, 0) results in 
77^ J2j \3i x ji^)i which in some sense "contains" all the bits Xj. 

In terms of linear algebra, a quantum gate network A with T queries can be viewed as follows: 
first A applies some unitary operation Uq to the initial state, then it applies O, then it applies 
another U\, another O, and so on up till Ut- Thus A corresponds to a big unitary transformation 

A = UtOUt-iO . . . OU x OUq. 

The behavior of O depends on X, but the U{ are fixed unitary transformations independent of X. 
We fix the initial state to |0), independent of X. The final state is then a superposition A|0) which 
depends on X only via the T query gates. 

One specific bit of the final state (the rightmost one, say) is considered the output bit. The 
output of the network is defined as the value we obtain if we observe this bit. Note that the output 
is a random variable. The acceptance probability of a quantum network on a specific black-box X is 
defined to be the probability that the output is 1. The key lemma of | |BBC + 98| ] gives the following 
relation between a T-query network and a polynomial that expresses its acceptance probability as 
a function of X (such a relation is also implicit in some of the proofs of [FR98, FFKL93] ]): 



Lemma 1 The acceptance probability of a quantum network that makes T queries to a black-box 
X, can be written as a real-valued multilinear N-variate polynomial P{X) of degree at most 2T. 

Note that if we want to compute a Boolean function, then the acceptance probability P(X) 
should be close to 1 if f(X) = 1, and P(X) should be close to if f(X) = 0. Since the degree 
of P is < 2T, a lower bound on the degree of a polynomial with such properties implies a lower 
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bound on T. See [BBC + 98[ for some of the lower bounds on quantum query complexity that can 
be obtained in this way. 

An iV-variate polynomial P of degree d can be reduced to a single-variate one in the following 
way (due to [MP68]). Let P s y m be the polynomial that averages P over all permutations of its 
input: 



P sym (X) 



psym - g an 7V_ var i a te polynomial of degree at most d. It can be shown that there is a single-variate 
polynomial Q of degree at most d, such that P s v m (X) = Q{\X\) for all X G {0,1}^. Here \X\ 
denotes the Hamming weight (number of Is) of X. 



3 Lower Bound on the Error in Quantum Search 

In this section we establish a general lower bound on the error probability in quantum search. 
Consider an unordered list of ./V items. We will abstract from the specific contents of the items, 
treating the list like a kind of black-box. A query at place j of the list just returns one bit Xj, 
indicating whether the jth item on the list has the property we are looking for. A query gate 
performs the following mapping, which is our only access to the bits xj: 

\j,b,0) -» \j,b® Xj ,0), 

where b is a bit and is a string of zeroes. The aim is to find a j such that Xj = 1 (if there is one), 
using as few queries as possible. 

Rather than proving a lower bound on search directly, we will prove a lower bound on computing 
the OR-function (i.e. determining whether X contains at least one 1). This clearly reduces to search. 
The main idea of our proof is the following. By the lemma of the previous section, the acceptance 
probability of a quantum computer with T queries that computes the OR with error probability 
< e can be written as a multivariate polynomial of degree < 2T of the N bits in the list. This 
polynomial can be reduced to a single-variate polynomial s of degree d < 2T with the following 
properties: 

s (o) = oQ 

1 — e < s(x) < 1 for all integers x £ [1, N] 

We will prove a lower bound on e in terms of d, which implies a lower bound in terms of T. Because 
we can achieve e = iff T = N [BBC + 98, Proposition 6.1], we assume T < N and hence e > 0. 



Define p(x) = 1 — s(N — x). Then p has degree d and 

< p{x) < e for all integers x £ [0, N — 1] 
p(N) = 1 



Thus p is "small" at integer points in [0,N — 1] and "big" at N. Coppersmith and Rivlin [CR92, 
p. 980] prove the following theorem, which allows us to show that p is also "small" at non-integer 
points in [0, N — 1]. 

2 Since we can always test whether we actually found a solution at the expense of one more query, we can assume 
the algorithm always gives the right answer 'no' if the list contains only 0s. Hence s(0) = 0. However, our results 
remain unaffected if we allow a small error here also (i.e. < s(0) < e). 
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Theorem 1 (Coppersmith 8z Rivlin) There exist positive constants a and b with the following 
property. For every polynomial p of degree d such that 

\p{x)\ < 1 for all integers x G [0, n] 

and any 5 > such that n > 5d 2 , we have 

\p(x)\ < ae b / s for all real x G [0, n]. 

Let 5 = (N — l)/d 2 . Applying Coppersmith and Rivlin's theorem to p/e (which is bounded by 
1 at integer points) we obtain: 

\p(x)\ < eae b/s for all real x G [0,N -1}. 

Now we rescale p to q(x) = p((x + l)(N — l)/2) (i.e. the domain [0,iV— 1] is transformed to [—1,1]), 
which has the following properties: 

\q(x)\ < eae h l & for all real x G [—1, 1] 

For [i = 2/(N - 1) we have q(l + fi) = p(N) = 1 

Thus q is "small" on all x G [—1, 1] and "big" just outside this interval (g(l + /i) = 1). 
Let Td denote the degree-d Chebyshev polynomial [ Riv9C ] : 

Td{x) = i ((x + yjx 2 -lf+ (x - Vx 2 -l) d ^j . 

The following is known: 

• If q is a polynomial of degree d such that \q(x)\ < c for all x G [—1, 1] then \q(x)\ < c\Td(x)\ 
for all |x| > 1 Fat92| , Fact 2} |Ri^90| , p.108] 

• T d (l + /i) < e 2d V 2 M+M 2 for all n > JPat92| , p.471, before Fact 2f\ 
Linking all this we obtain 

1 = q (l + M ) < eae b/5 |T d (l + /i)| < eae b / 5 + 2d V 2 M+M 2 . 

This shows that if q is "big" just outside the interval [—1, 1], then it cannot have been very small 
inside this interval, so e cannot have been very small. Substituting 5 = (N-l)/d 2 and [i = 2/(N-l) 
we obtain the following lower bound on e: 

e > - e - bd2 /{N-l)-U/yJ N/(N-1) 2 _ 

— a 

Since d < 2T, where T is the number of queries of the quantum search algorithm, we have (simpli- 
fying a bit): 



Theorem 2 IfT<N then e G O ^tVn-8T/Vn^ 
We note some special cases of this general theorem: 



3 For x = 1 + n: T d (x) < (x + Vx 2 - l) d = (1 + M + V 2 ^ + V 2 ) d < (1 + 2^2^ + /i 2 ) d < e 2d ^ 2fl+fl2 (Paturi, 
personal communication). 
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Corollary 1 No quantum network for bounded- error search of an unordered list that uses 0{^/N) 
queries can have error probability o(l). 



For instance, an error < 1/N cannot be achieved using only 0(\HV) queries.^ 

Corollary 2 Every quantum network for bounded-error search of an unordered list that uses < 
queries (a > 0) must have error probability ft (l/2 cN2a ) (where c > is some fixed con- 
stant). 

In particular, this shows that we cannot obtain error probability < 1/2 N unless we have a = 
0.5 and thus use U(N) queries. [ BCW98| , Theorem 1.16] proves the upper bound that the error 



probability can be made as small as 1/2 N " using O(N ' 5+a ) queries, so there is still a gap between 
upper and lower bound. 

Finally, a lower bound on T in terms of e and N: 

Corollary 3 IfT(N)/y/N -> oo but T < N , then Te!l ^iVlog(l/e)) . 

4 The Influence of the Number of Solutions 

Suppose we have a quantum search algorithm that uses T queries and works well (i.e. has error 
< e) whenever the number of Is in the list of iV items is either or at least t. (Here t is some 
fixed number < N.) Such an algorithm induces a polynomial of degree d < 2T with the following 
properties: 

s(0) = 

1 — e < s(x) < 1 for all integers x G [t, N] 

Define p(x) = 1 — s(N — x), which has degree d and 

< p{x) < e for all integers x £ [0, N — t] 
p(N) = 1 

Now we define q(x) = p((x + l)(N — 1)/2), 5 = (N — t)/d 2 and \x = 2t/(N — t), and derive completely 
analogous to the previous section: 

1 = q(l + n) < eae b/5 \T d (l + < £ae b / 5 + 2d V^ 2 

= eae bd2 /( N ~ t )+ 2d V 4t /( N - t )+ it2 /( N ~ t ) 2 

= £ae bd 2 /(N-t)+Ad^tN/(N-t) 2 _ 

Hence for quantum search in this situation we have the bound: 

e G L-b<f/(N-t)-^tN/(N-t)A G q ^ e -4bT 2 /(N-t)-8T^tN/(N-t)2 ^ 

pBHT9^ ] proves that an expected number of 0(y/N/t) queries is sufficient to search with high 
probability. If we put T = c^/N/t then the lower bound on the error probability becomes roughly 
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Which is too bad, because such a small error wo uld reduc e the quantum complexity of £2 (the second level of 



the polynomial hierarchy) from 0(V2"n) to 0(V2") BCW98| 
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Q(e" cc ) (for some constant d > 0), which can indeed be made arbitrarily small by increasing c. 
On the other hand, if T € o(y / N/t) then the lower bound on the error goes to the constant 1/a for 
N —* oo and t = o(N). Now if we were able to achieve some error < 1/2 using o{^jN/t) queries, 
we could also make the error < 1/a by repeating a constant number of times, which would still 
take only o{y/ N/t) queries. This shows that we cannot achieve error < 1/2 using o{\/N/t) queries. 
Thus the 0{\jN/i) upper bound is tight up to a constant factor (as already shown in a different 
way in HBBHT98H ). 

5 Application to Derandomization of RP 

Let A be some RP-algorithm for a language L with running time < p(n). A always gives the right 
answer 'no' for every input x L, and gives the right answer 'yes' with probability at least 1/2 for 
every x S L. We want to lower the error probability using as few calls to A as possible. For a fixed 
input x of length n we can consider A as a black-box of N < 2 P ^ items. Each item corresponds 
to the value A outputs when given a specific random string (A can use at most p(n) random bits 
and hence at most 2 P ^ distinct random strings). By definition of RP, this black-box satisfies the 
promise that either it contains Is (if x L) or at least N/2 Is (if x £ L). 

A classical computer can improve the error probability to at most l/2 k by making k black-box 
queries (i.e. k applications of the algorithm on k different random strings) and answering 'yes' iff 
at least one those k queries answered 'yes'. How much better can a quantum computer do, if we 
only allow it to call A as a black-box? Note that the classical method basically searches through 
a list of k items, looking for a 1. Accordingly, the following quantum algorithm suggests itself: 
select k random strings and search whether one of these gives a 'yes' in 0(y/k) applications of 
the algorithm. Thus we would expect a quantum computer to be able to achieve the same error 
probability < 1 /2 k using roughly yfk applications of the algorithm instead of k. 

However, note that the situation here corresponds exactly to the previous section with t = N/2. 
Thus if the quantum computer makes T queries and has error probability e on the worst-case 
black-box, then 

e G O (V 8 ^" 8 ^) . 

If we want e < l/2 k (for some fixed k and all N), it follows that T > ck, for some c > that does 
not depend on k^\ Thus the quantum algorithm cannot achieve the square-root speed-up that we 
expected; it can achieve at most a linear speed-up. 

Why does the above-mentioned v^-method not work? The reason is that the quantum searching 
algorithm itself has some error probability, in addition to the probability < l/2 k that the chosen 
sample of k items does not contain a 1 when the larger list of N items does contain a 1. The 
error introduced by quantum search can only be made sufficiently small at the cost of increasing k 
and/or the number of queries spent. 

In sum: on a classical computer we can amplify an RP-algorithm to error probability e < l/2 fc 
using k applications of the algorithm, on a quantum computer we cannot do much better: we still 
need at least ck applications to achieve error e < l/2 k , provided we use the RP-machine only as a 
black-box. 



5 For sufficiently large k, c will be roughly l/8\/21oge « 0.06. 
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6 Lower Bound on Search in an Ordered List 



Grover's algorithm can find a specific item in an unordered list of N items with high probability, 
using only 0(y/~N) queries (a.k.a. database look-ups), whereas a classical algorithm needs &(N) 
queries for this. There exist several lower-bound proofs that show that the 0(\/~N) is optimal 
[ BBBV97| , [BBHT98| , Eajg7| , |BBC+98| , |Gro98afl . 



What about search in a list of N items which is ordered according to some key-value of each 
item? A classical deterministic algorithm can search such a list using logiV queries by means of 
binary search (each query can effectively halve the relevant part of the list: looking at the key of 
the middle item of the list tells you whether the item you are searching for is in the first or the 
second half of the list). How much better can we do on a quantum computer? Can we again get a 
square-root speed-up? Here we show that the speed-up cannot be much better than a square-root: 
we prove a lower bound of Q(y/log N / log log N) queries for bounded-error quantum search of an 
ordered list. In contrast, we have no upper bound better than the classical logiV. 

We will formalize a query on an ordered list as follows, abstracting from the specific contents of 
the key field. The list is viewed as a list of N bits, xq, . . . ,xn—i, an d there is an unknown number 
i such that Xj = 1 iff j < i. Here Xj being 1 can be interpreted as saying that the jth item on the 
list has a key-value smaller or equal to the value we are looking for. The goal is to find the number 
i, which is the point in the list where the looked- for item resides, using as few queries as possible. 
In quantum network terms, a query corresponds to a gate C that maps 

\j,b,0) -» \j,b® Xj ,0). 

The following theorem proves a lower bound of roughly yTogiV queries for quantum searching an 
ordered list with bounded error probability. To improve readability, we have deferred some of the 
more technical details to the appendix. Basically these show that we can approximately simulate 
the gate C using roug hly VlogiV queries to a black-box of log N bits that represents the number i. 

Theorem 3 A quantum network for bounded-error search of an ordered list of N items must use 
at least Q(y/\ogN / log log N) queries. 

Proof Suppose we have a network S for bounded-error ordered search that uses T queries to find 
the number i hidden in an ordered black-box X with high probability. Since logiV queries are 
sufficient for this (classical binary search), we can assume T < logiV. We will show how we can 
get from S to a network S that determines the whole contents of an arbitrary black-box Y of log N 
bits with high probability, using only T ■ 0( \/log N log log N) queries to Y. This would allow us to 
compute the PARITY- function of Y (i.e. whether or not Y contains odd many Is). Since we have 
a (logiV)/2 lower bound for the latter |BBC + 98 , Proposition 6.4], we have 



/ log N 

T ■ 0( VlogT/V log log N) > -|-, 

from which the theorem follows. 

So let Y be an arbitrary black-box of log N bits. This represents a number i G {0, . . . ,N — 1}. 
Let X = (xo, . . . , xjv-i) be the ordered black-box corresponding to i, so Xj = 1 iff j < i. The 
network S, when allowed to make queries to X, outputs the number i with high probability. A 
query-gate C for X maps 

\j,b,0) -» \j,b® Xj ,0). 
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Since Xj = 1 iff j < i, Lemmas ||| and [| of the appendix imply that there is a quantum network C 
that uses 0(- v /log N log log N) queries to Y and maps 

\j,b,0) -> U,6©x„0) + |i)|W jfe ), 

where || |W}&) ||< n/logN for all j, 6, for some small fixed n of our choice. 

Let S be obtained from S 1 by replacing all T C-gates by C-networks. Note that S contains 
T ■ 0(\/log N log log N) queries to Y. Consider the way S acts on initial state |0), compared to S. 
Each replacement of C by C introduces an error, but each of these errors is at most V2r]/logN m 
Euclidean norm by Lemma [|. By unitarity these T errors add linearly, so the final states will be 
close together: 

|| S\0) - 5|0> || < Tyfirj/logN < V2 V . 

Since observing the final state S\0) yields the number % with high probability, observing 5*| 0) will 
also yield i with high probability. Thus the network 5 allows us to learn i, and hence the whole 
black-box Y. □ 
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A Some Technical Lemmas 

Our lower-bound proof for ordered search uses three technical lemmas. 

The first lemma can be obtained from the result of Diirr and H0yer [pH96 ] that a quantum 
algorithm can find the minimum element on a list of N items using 0(y/~N) queries. We can use this 
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to find the leftmost bit where two lists differ, which tells us which of the two numbers represented 
by the two lists is bigger. 

Lemma 2 There exists a quantum algorithm A that with bounded error probability outputs on input 
j (0 < J ; < N — 1) whether j is smaller or equal to a number i represented by a black-box of log N 
bits, using 0(\/log N) queries to the black-box. 

By standard techniques, we can make the error probability 0(1/ log N) by repeating the algo- 
rithm O (log log N) times. 

The second lemma shows how to obtain an approximately "clean" computation that uses no 
measurements (the proof is as in |CDNT97| , Section 3] and flBCW98| , Theorem 1.14]). 



Lemma 3 Suppose there exists a quantum algorithm A that uses T queries and outputs a bit Xj 
with error probability < e on initial state \j,0), for every j, and does not change the j-register. 
Then there exists a quantum algorithm A' that uses 2T queries and no measurements, and maps 

\j,b,o) -> \ j,be Xj ,o) + \j)\w jb ), 

where \\ \Wj b ) \\< \[2e, for every j and b G {0, 1}. 

Proof The idea is the familiar "compute, copy answer, uncompute" -sequence. By standard 
techniques, we can assume A itself uses no measurements and is followed by a single measurement. 
Then there exist amplitudes «o an d ot\ and unit-length vectors | Vq) and |Vi) such that 

A\j,0,0) = a \j,Xj)\V ) + ai\j,Xj)\Vi), 

and |ai| 2 < e. For ease of notation, we assume this state is preceded by the bit b. Applying the 
controlled-not operation that maps \b,j, x) — > \b © x,j, x), we get 

a \b Xj,j,Xj}\V ) + ai\b®Xj,j,xj)\Vi) = 

\b © Xj) (a \j,Xj)\V ) + ai\j,xj)\Vi)) + ai\b © xj, j,x])\Vi) - at\b® Xj, j,xj)\Vi). 
Applying / (g) A -1 gives 

\b®xj)\j,0,0) + (I® A' 1 ) (ai\b®xJ,j,x])\Vi) -ai\b®Xj,j,Z])\Vi)). 

Applying an operation B which swaps the first bit and j, we get 

|j, 6 ffiz.,-, 0,0) + B(I <g> A^ 1 ) (ai\b®x],j,x])\Vi) - a x \b © Xj,j,Xj)\Vi)) . 

Note that B(I (g> A' 1 ) (a>i\b © xj, j, x~j)\V\) - a\\b © Xj, j, xj)\Vi)) = \j)\W jb ) for some \W jb ), be- 
cause A and hence also A -1 do not change j. Now 

\\\W jb )\\ = || \j)\W jb ) || 

= || B(I® A' 1 ) (ai|&ffiSJ, j,x])\Vi) -ai\b®Xj,j,x])\Vi)) \\ 
= || ax\b®Xj,j,Xj)\Vi) - a 1 \b®Xj,j,x])\Vi) \\ 

= \j2\ ai \ 2 < V2e. 

Thus the quantum algorithm A' which first applies A, then XORs the answer-bit into b, and then 
applies A^ 1 , satisfies the lemma. □ 



The next lemma uses an idea from ||CDNT97| 1. It shows that if we can simulate a gate C by 



means of a network C that works well on basis states, then C also works well on superpositions of 
basis states. 
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Lemma 4 Let C and C be unitary transformations such that 

C:\j,b,0) - \j,b® Xj ,0) 
C:\j,b,0) - |i,6©x j ,0) + |j)|^ b ) 

-^f || |Wj'&) ||< e f or every j € {0, . . . , N — 1} and 6 G {0, 1} ; and |0) = £)- 6 a^j, 6, 0) has norm 1, 
then 

|| C\(f>)-C\<f>} \\<V2s. 
Proof 

= HE«^')I^)II 

3,b 

< iiEMi)i^-o)ii + iiEMi)i^i)ii 

3 j 



= ( (ew ii mw j0 ) ii 2 + Jem 2 ii i^i) 



(2) 



< yEM 2 +^EM 2 ^ 

Here (1) holds because the states |j)|Wjf>) in X)j a j& 1.7)1 Wj'ft) are all orthogonal, and (2) holds 
because \fa + \f\ — a < \/2 for all a6 [0,1]. □ 
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